DOCTOR IMPROVEMENTS: visual improvements/grouping + add comprehensive tests + fix gosec warnings (#656)

* test(doctor): add comprehensive tests for fix and check functions

Add edge case tests, e2e tests, and improve test coverage for:
- database_test.go: database integrity and sync checks
- git_test.go: git hooks, merge driver, sync branch tests
- gitignore_test.go: gitignore validation
- prefix_test.go: ID prefix handling
- fix/fix_test.go: fix operations
- fix/e2e_test.go: end-to-end fix scenarios
- fix/fix_edge_cases_test.go: edge case handling

* docs: add testing philosophy and anti-patterns guide

- Create TESTING_PHILOSOPHY.md covering test pyramid, priority matrix,
  what NOT to test, and 5 anti-patterns with code examples
- Add cross-reference from README_TESTING.md
- Document beads-specific guidance (well-covered areas vs gaps)
- Include target metrics (test-to-code ratio, execution time targets)

* chore: revert .beads/ to upstream/main state

* refactor(doctor): add category grouping and Ayu theme colors

- Add Category field to DoctorCheck for organizing checks by type
- Define category constants: Core, Git, Runtime, Data, Integration, Metadata
- Update thanks command to use shared Ayu color palette from internal/ui
- Simplify test fixtures by removing redundant test cases

* fix(doctor): prevent test fork bomb and fix test failures

- Add ErrTestBinary guard in getBdBinary() to prevent tests from
  recursively executing the test binary when calling bd subcommands
- Update claude_test.go to use new check names (CLI Availability,
  Prime Documentation)
- Fix syncbranch test path comparison by resolving symlinks
  (/var vs /private/var on macOS)
- Fix permissions check to use exact comparison instead of bitmask
- Fix UntrackedJSONL to use git commit --only to preserve staged changes
- Fix MergeDriver edge case test by making both .git dir and config
  read-only
- Add skipIfTestBinary helper for E2E tests that need real bd binary

* test(doctor): skip read-only config test in CI environments

GitHub Actions containers may have CAP_DAC_OVERRIDE or similar
capabilities that allow writing to read-only files, causing
the test to fail. Skip the test when CI=true or GITHUB_ACTIONS=true.

cmd/bd/doctor/fix/untracked.go

@@ -19,7 +19,8 @@ func UntrackedJSONL(path string) error {
 	beadsDir := filepath.Join(path, ".beads")
 
 	// Find untracked JSONL files
-	cmd := exec.Command("git", "status", "--porcelain", ".beads/")
+	// Use --untracked-files=all to show individual files, not just the directory
+	cmd := exec.Command("git", "status", "--porcelain", "--untracked-files=all", ".beads/")
 	cmd.Dir = path
 	output, err := cmd.Output()
 	if err != nil {
@@ -67,9 +68,11 @@ func UntrackedJSONL(path string) error {
 		fmt.Printf("  Staged %s\n", filepath.Base(file))
 	}
 
-	// Commit the staged files
+	// Commit only the JSONL files we staged (using --only to preserve other staged changes)
 	commitMsg := "chore(beads): commit untracked JSONL files\n\nAuto-committed by bd doctor --fix (bd-pbj)"
-	commitCmd := exec.Command("git", "commit", "-m", commitMsg)
+	commitArgs := []string{"commit", "--only", "-m", commitMsg}
+	commitArgs = append(commitArgs, untrackedFiles...)
+	commitCmd := exec.Command("git", commitArgs...) // #nosec G204 -- untrackedFiles validated above
 	commitCmd.Dir = path
 	commitCmd.Stdout = os.Stdout
 	commitCmd.Stderr = os.Stderr